DE69625953T2 - Method and device for achieving high integrity and availability in a multi-channel system - Google Patents

Abstract

A multi-channel system (31) which monitors and identifies faults experienced by elements of the system is provided in accordance with the present invention. The multi-channel system comprises a plurality of line replaceable units (30 or 38) and independent control channels (40, 42 and 44) coupled to a global bus (34). The control channels and the line replaceable units are coupled to the global bus such that each computer channel and each line replaceable unit is a transmitter that transmits messages via the global bus. Each channel contains a plurality of lanes (46, 48 and 50) coupled by a private bus (56), wherein each lane comprises a power supply (52), a processor (54) and an interface (60) to the global bus. However, only one lane of each channel, i.e., the command lane, may transmit messages via the global bus. The processor of each lane of each channel generates a channel majority opinion for each transmitter connected to the global bus that indicates whether a majority of the channels have detected a fault in the transmitter. To determine the channel majority opinion, the processor for each lane of the channel must first generate a lane majority opinion of the channel that indicates whether a majority of the lanes of the channel have detected a fault in the transmitter communicating via the global bus. The command lane of each channel then transmits the lane majority opinion of the channel to each of the other channels via the global bus such that each lane of each channel receives the lane majority opinion generated by the command lane of each of the other channels. The processor of each lane of the channel then qualifies the lane majority opinion of each channel to ensure that the fault detected is not due to a fault in the channel whose command lane sent the lane majority opinion. The processor of each lane then generates a final lane majority opinion of each channel indicating whether a majority of the lanes of the channel have continued to detect the fault in the transmitter after the lane majority opinions of each channel have been qualified. Finally, the processor of each lane of the channel generates the channel majority opinion by determining if a majority of the channels have persistently generated a final majority opinion indicating that the transmitter is experiencing a fault. In other embodiments of the invention, the channel majority opinion is further processed by the processor of each lane of each channel to identify the type of fault the transmitter is experiencing, i.e., whether the fault is intermittent or constant, to identify faults in the global bus and to identify faults within the channels. <IMAGE>

Description

Field of the invention

The present invention relates generally to avionic multi-channel control systems for wire-guided flight, and more particularly to a method and apparatus for maintaining high integrity and availability in avionic multi-channel control systems for wire-guided flight.

Background of the invention

Before the advent of wire-guided flight technology, the flight control surfaces on a commercial aircraft were controlled using a complicated system of cables and mechanical controls. With the advent of wire-guided flight technology, such mechanical control systems have been replaced by a wire-guided flight system that has no direct mechanical couplings between pilot controls and flight control surfaces. Instead of using mechanical couplings such as cables, a wire-guided flight system includes pilot control transducers that sense the position of the pilot controls and generate electrical signals proportional to the position of the pilot controls. The electrical signals are combined with other aircraft data in the primary flight computer to generate a flight control surface command that controls the movement of the commercial aircraft's flight control surfaces.

Because safety is always a high priority in the aircraft industry, wire-guided flight systems usually contain redundant components so that if one component of the system fails, a pilot can still safely control the aircraft. An example of such a wire-guided flight system is described in commonly assigned U.S. patent application Serial No. 07/893,339, entitled Multi-Access Redundant Fly-By-Wire Primary Flight Control System, to Buus, filed June 3, 1992, which corresponds to European patent application EP-A-0 573 106, the disclosure and drawings of which substantially reflect the prior art from which the present invention is distinguished by providing a method and apparatus with improved integrity and availability. The described wire-guided flight system is divided into a number of independent control channels, wherein each control channel is substantially isolated from the other control channels within the system. As a result, a malfunction occurring in one channel does not affect the continued operation of the remaining channels, such that a pilot can fly the aircraft using only one channel. This typical wire-guided flight system includes many other redundant systems to ensure the safety of the passengers and crew. For example, it includes autopilot flight control computers, air data modules, engine indication and crew warning systems, aircraft information management systems, etc. The independent control channels are in direct communication with these aircraft systems via a global communications data bus. However, each component of the wire-guided flight system, including the global communications data bus, includes a potentially weak link that could cause a problem in the event of a failure of that component. or in the case of a broken or loose connection to that component. If the problem goes undetected, or if the problem is not correctly identified, the results can be disastrous.

Consequently, there is a need to provide wire-guided flight systems with the ability to monitor and identify failures or faults in aircraft components. Due to the very stringent safety requirements applied to the wire-guided flight system, it is necessary that a high level of integrity be maintained, such that the numerical probability of experiencing a failure in the system, either a passive failure resulting in a loss of function without significant immediate aircraft recovery, or an active failure resulting in an aircraft component malfunction with significant immediate aircraft recovery, is less than 1.0E-10 or 1.0F-10 per flight hour, respectively. The availability of the system should be maximized by avoiding fault assessment of the aircraft components while achieving the required level of integrity described above. Further, there is a need for such a system to distinguish between faults and failures occurring in the independent control channels and faults occurring in the global communications bus or other aircraft components. The present invention is directed to meeting these and other needs of avionic wire-guided control systems of flight.

Summary of the invention

According to this invention, a multi-channel system that monitors and identifies failures experienced by elements of the system is provided by the present invention. The multi-channel system includes a plurality of line-replaceable units and independent control channels coupled to a global bus. The control channels and line-replaceable units are coupled to the global bus such that each computer channel and line-replaceable unit is a transmitter that transmits messages over the global bus. Each channel includes a plurality of threads connected by a private bus, wherein each thread includes a power supply, a processor, and an interface to the global bus. However, only one thread of each channel, i.e., the command thread, can send messages over the global bus.

Each computer channel monitors and detects failures in the multi-channel system in the same manner. As a result, only the operation of the threads of one channel is combined. Accordingly, the processor of each thread of the channel generates a channel majority opinion for each transmitter connected to the global bus indicating whether a majority of the channels have detected a failure in the transmitter. To determine the channel majority opinion, the processor must first generate a channel thread majority opinion for each thread of the channel indicating whether a majority of the threads of the channel have detected a failure in the transmitter communicating over the global bus. The command thread of each channel then sends the thread majority opinion of the channel to each of the other channels via the global bus.

After each thread of the channel has received the thread majority opinion generated by the command thread of each channel, the processor of each thread of the channel qualifies the thread majority opinion of each channel to ensure that the detected failure did not result from a failure in the channel whose command thread sent the thread majority opinion. If that channel is not currently experiencing a failure, the processor of each thread generates a qualified thread majority opinion for that channel indicating whether the majority of the threads of that channel have detected a failure in the transmitter. After the processor has generated a qualified majority opinion for each channel from each thread in this manner, the processor sends the qualified majority opinion to the other threads of the channel via the channel's private bus.

Next, the processor of each thread generates a final thread majority opinion of each channel. The final thread majority opinion of each channel indicates whether a majority of the threads of the channel have continued to detect the failure in the transmitter after the thread majority opinion of the channel has been qualified. Accordingly, the final thread majority opinion indicates whether the transmitter is currently experiencing a failure. The final thread majority opinion of each channel is generated by the processor of each thread by determining whether a majority of the strands of the channel have persistently generated a qualified or designated strand majority opinion for the channel indicating that the sender is currently experiencing the failure.

Finally, the processor of each leg of the channel generates the channel majority opinion by determining whether a majority of the channels have consistently generated a final majority opinion for the channel indicating that the transmitter is experiencing a failure.

In other preferred embodiments of the present invention, the channel majority opinion is further processed by the processor of each thread to identify the type of failure the transmitter is currently experiencing, i.e., whether the failure is intermittent or constant, to identify failures in the global bus, and to identify failures within the channels.

A method that is generally consistent with the functions implemented by the elements of the multi-channel system described above is another aspect of this invention.

These objects are solved in an advantageous manner basically by applying the features laid down in the independent claims. Further enhancements are provided by the subclaims.

It is hereby confirmed that from "IEEE Computer", Volume 24, No. 5, 1 May 1991, pages 12-22, XP 000230771, Lala JH et al. "A design approach for ultrareliable real time systems" a redundancy-based technology is known in which Signals from a plurality of line-replaceable units performing the same function are compared by a system including channels one more in number than the plurality of line-replaceable units.

Short description of the drawings

The foregoing aspects and many of the attendant advantages of this invention will be more readily appreciated as the same becomes better understood by reference to the following detailed description when taken in conjunction with the accompanying drawings, in which:

Fig. 1 is a block diagram of a wireline controlled multi-channel flight system including three channels (i.e., three primary flight computers or "PFCs") connected to a plurality of line replaceable units (LRUs) via a global communications bus;

Fig. 2 is a detailed block diagram of the PFC shown in Fig. 1, wherein each PFC includes three computational threads used to monitor and detect failures in the wire-guided flight system according to the present invention;

Figures 3A and 3B are block diagrams showing the form in which information is sent between the channels and the LRUs over the global communications data bus;

4A, 4B and 4C are functional block diagrams showing how a channel monitors and identifies failures in the wire-guided flight system according to the present invention;

Fig. 5 is a flow diagram showing the logic used by each thread of a channel to determine whether the thread suspects that an LRU is experiencing a failure;

Fig. 6 is a flow diagram illustrating the logic used to determine whether a majority of the threads of a channel suspect that an LRU is experiencing a failure;

Fig. 7 is a flow chart illustrating the steps used to determine whether only one leg of the channel suspects that an LRU is experiencing a failure;

Fig. 8 is a flow chart showing the steps used to qualify the determination made in Fig. 7;

Fig. 9 is a flow diagram illustrating the steps used to determine whether a majority of the threads of a channel still suspect that an LRU is experiencing a failure after qualification;

Fig. 10 is a flow diagram illustrating the steps used to determine whether a majority of the channels have determined that an LRU has experienced a failure;

Fig. 11 is a flow chart showing the steps used to determine whether the global communication bus is experiencing a failure;

Fig. 12 is a flow chart showing the steps used to determine whether an LRU or the global communications bus is experiencing intermittent failures;

Fig. 13 is a flow chart showing the steps for determining whether the PFC and the LRUs are active and communicating over the global communication bus; and

Fig. 14 is a flowchart showing the steps used to determine whether an LRU is inactive.

Detailed description of the preferred embodiment

A block diagram of a critical multi-channel avionics electronic control system 31 for wire-guided aircraft control is shown in Fig. 1. The wire-guided aircraft control system 31 includes three independent and isolated flight control channels, i.e., three independent and isolated primary flight computers or PFCs, comprising a left flight control channel 40, a center flight control channel 42, and a right flight control channel 44 (the term "channel" and the term "PFC" are used interchangeably throughout the following description). The control channels 40, 42, and 44 are physically and electrically isolated from one another such that a failure in one of the channels does not adversely affect the operation of the other channels. To achieve such isolation, the three independent control channels must operate asynchronously. However, asynchronous operation causes a time delay between the channel functions. Someone from Those of ordinary skill in the avionics art will recognize that such delays are accounted for and accommodated by various parameters of the wireline system. However, these parameters are not described, it being believed that an understanding of them is not necessary to an understanding of the present invention.

Each channel or PFC 40, 42 and 44 transmits and receives flight control signals to and from the other avionics components of the aircraft via a global communications bus 34. These avionics components include: autopilot flight command system computers, air data modules, engine indication and crew alert systems, aircraft information management systems, etc. Since the type of avionics component and the function and purpose of each avionics component is unimportant for purposes of describing the present invention, these components are generally referred to and identified in Figure 1 as line replaceable units (LRUs) 30, which is a well-known term in the art used to describe avionics components that can be manually plugged into the aircraft as a unit and manually removed from the aircraft as a unit.

Each of the LRUs 30 transmits data to the PFCs 40, 42 and 44 over the global communications bus 34 for use in determining control surface commands. The global communications bus 34 includes three data buses, a left bus 33, a center bus 35 and a right bus 37. In the preferred embodiment, the data buses 33, 35 and 37 are digital links in accordance with ARINC 629, which is a standard in the aircraft industry; however, other types of data links may be used.

Each flight control channel of the control system controls each of the aircraft's flight control surfaces via a special type of LRU, ie, an actuator control electronics (ACE) unit 38, such that a pilot can fly the aircraft using only one channel. In this regard, a number of redundant ACEs 38 receive pilot control signals from the aircraft's control column, steering wheel, pedals, rudder, etc. (not shown). The ACEs 38 then transmit the pilot control signals to each of the channels 40, 42 and 44 over the global communications bus 34. The channels generate a series of flight control surface commands based on the pilot control signals received by the ACEs and the data received from the LRUs 30, and transmit the flight control surface commands back to the ACEs 38 over the global communications bus 34. The ACEs 38 perform a digital-to-analog conversion of the flight control surface commands generated by each of the channels and transmit the converted signals to a plurality of power control units (PCUs) 36 which control the movement of an individual flight control surface on the aircraft. It will be appreciated that no errors should occur in the communication between any of these avionics components over the global communications bus. As will be better understood from the following description, the present invention detects errors in the communication between the ACEs 38, the LRUs 30 and the channels 40, 42 and 44 over the global communication bus 34 and determines whether the error results from a permanent or intermittent defect or failure in a particular LRU or in the global communication bus 34, or from a defect or failure within a channel itself. For purposes of the following Description it will be recognized that the term "LRU" also refers to the ACEs.

Figure 2 shows the internal components of each channel 40, 42 and 44 as coupled to the global communications bus 34. Since the channels 40, 42 and 44 are virtually identical, the following description of the left channel 40 applies equally to the center and right channels 42 and 44. Therefore, the center and right channels will not be discussed in detail.

The left channel 40 includes three redundant computation threads 46, 48 and 50. Each thread includes a power supply (PS) 52, a microprocessing unit (MPU) 54 and an input/output (I/O) interface 60. The interface 60 of each thread allows the thread to be directly connected to the global communications bus 34. The MPUs 54 of each thread of the channel 40 are connected by a private inter-thread data bus 56 which allows the MPUs 54 and, accordingly, the threads 46, 48 and 50 of the channel 40 to communicate with each other. However, in the preferred embodiment of the present invention, the microprocessor hardware of each MPU is dissimilar to facilitate detection of general design errors present in any microprocessing chip. For example, the microprocessing unit 54 of the strand 46 may include the 29050 microprocessor chip manufactured by Advanced Micro Devices, the MPU 54 of the strand 48 may include the 68040 microprocessor chip manufactured by Motorola, and the MPU 54 of the strand 50 may include the 80486 microprocessor chip manufactured by Intel. One of ordinary skill in the art will recognize that the MPUs 54 may include many more components than those shown in FIG. 2, however, such other components will not be described because they are conventional and it is believed that an understanding of the same is not necessary for an understanding of the present invention.

Regardless of type, the MPU 54 of each strand 46, 48 and 50 is connected to the I/O interface 60 by a data bus 58 located within the strand. The interface 60 is then coupled to the global communications bus 34 such that the interface can receive signals from the center bus 35 and the right bus 37, and can both send and receive data over the left bus 33. The interface 60 also includes three error registers 62, 63 and 64, with one error register connected to each data bus 33, 35 or 37, the error registers being 16-bit error registers in a preferred embodiment of the invention. One of ordinary skill in the art will recognize that the interface 60 includes many more components than those shown in Figure 2, however, such other components will not be described because they are conventional and it is believed that an understanding of them is not necessary for an understanding of the present invention.

Although each of the strands 46, 48 and 50 is connected to the global communications bus 34, only one strand is permitted to transmit messages 78 over the global communications bus at any one time. This strand is referred to as the "command strand." In the illustrated embodiment, the strand 46 of channel 40, the strand 48 of channel 42 and the strand 50 of channel 44 have been arbitrarily chosen for discussion to represent the command strand of their respective channels. However, it will be recognized by one of ordinary skill in the art that, based on the requirements of the wire-guided system 31, any branch 46, 48 or 50 of any channel 40, 42 or 44 may be the command branch.

As illustrated in Figures 3A and 3B, the channels 40, 42 and 44 and the LRUs 30 send data, commands, etc. (collectively referred to herein as data) over the global communications network 34 in the form of messages 78. Accordingly, each channel 40, 42 and each LRU 30 may be generally referred to as a transmitter (TMR). Each message 78 comprises a plurality of 16-bit word strings 70. In a current embodiment of the invention, the word strings are 16-bit word strings. Each word string 70 comprises a tag 72, a number of data words 74 and a cyclic redundancy check (CRC) word. The label 72 identifies the particular TMR sending the message 78; each data word 74 comprises 16 bits of data associated with the particular TMR; and the CRC word is used to indicate unwanted data corruption on the global communications bus 34. The strands 46, 48 and 50 of each channel 40, 42 and 44 are synchronized so that each strand synchronously receives and processes each received message 78. However, as described more fully below, each strand of each channel and, accordingly, each channel makes its own determination from these messages 78 as to whether an error has occurred in the global communications bus 34, the LRUs 30 or 38, or the PFCs 40, 42 and 44, and if so, makes a determination as to the cause of the error.

4A, 4B and 4C are functional block diagrams showing how channels 40, 42 and 44 monitor and identify faults in the wireline system 31 in accordance with the present invention to maintain a high level of integrity and availability in the system. Because the Because the functions performed by channels 40, 42 and 44 are virtually identical, only the functions as performed by one channel will be described. In the following description, this channel will be referred to as the "own channel" (OC), and it has been arbitrarily chosen for descriptive purposes to correspond to the left control channel 40 of the wireline system 31. Accordingly, channels 42 and 44 will be arbitrarily referred to as the "other channel 1" (OC1) and the "other channel 2" (OC2), respectively. However, if one were to describe the functions as performed by channel 42, channel 44 would be referred to as the "other channel 1" while channel 40 would be referred to as the "other channel 2". Accordingly, one of ordinary skill in the art will understand from this description that the functions performed in the "own channel" are equally well performed in the "other channels".

Referring now to Fig. 4A, there is illustrated the functions performed by the dedicated channel for monitoring and identifying faults in the wireline system 31. It will be readily appreciated by those of ordinary skill in the art that the functions described herein are performed synchronously by the MPU 54 of each leg 46, 48 and 50 of the dedicated channel. As shown in Fig. 4A, the process in each channel 40, 42 and 44 begins with the fault register monitor function. More specifically, a fault register monitor 100 monitors the messages 78 received by the channel over the global communications bus 34 from the LRUs 30 and 38 as well as the other channels 40, 42 and 44. For purposes of ease of illustration and discussion, the present invention shall be described as applied to a message 78' transmitted by a particular TMR, either a PFC or an LRU, over the global communications bus 34. Those of ordinary skill in the art will recognize that each message 78 sent by each LRU 30 or 38 or channel 40, 42 or 44 in the wireline system 31 is processed in the same manner as message 78'.

When each strand 46, 48 and 50 receives the message 78' from the specific TMR over one of the data buses 33, 35 or 37, the error register monitor 100 of that strand generates a receive error (RCVF) signal 20 indicating whether the specific TMR is currently transmitting a message that has excessive errors. Each strand of its own channel then sends its RCVF signal to the MPUs 54 of the other strands over the private data bus 56 of its own channel. Since each strand of the channel synchronously processes the message 78' received over the global communication bus 34, the MPU 54 of each strand will send its RCVF signal to the other MPUs at approximately the same time. Accordingly, each branch 46, 48 and 50 will receive three RCVF signals (generally designated by reference numeral 20) from its own channel.

In block 122, the MPU 54 of each of the strands 46, 48 and 50 performs cross-strand consolidation of the three RCVF signals 20 to determine whether a majority of the strands suspect that the particular TMR is currently transmitting a message 78' that has excessive errors. This determination is referred to as a strand majority opinion of the own channel and is generally designated in FIG. 4A by reference numeral 22. It will be appreciated that each strand of the own channel performs cross-strand consolidation of the three receive error signals 20 and that accordingly each strand determines a strand majority opinion 22. The command strand 46 of the own channel then transmits the strand majority opinion. to the other channels via the global communication bus 34.

As noted above, the other channel 1 and the other channel 2 also perform the functions just described. Accordingly, the command threads 48 and 50 of the other channel 1 and the other channel 2, respectively, transmit their own thread majority opinions 22 to the own channel (and to each other) over the global communications bus 34. As a result, each thread 46, 48 and 50 of the own channel receives the thread majority opinion 22 from each channel 40, 42 and 44 over the global communications bus 34. The microprocessor 54 of each thread 46, 48 and 50 of the own channel then qualifies each received thread majority opinion 22 (blocks 194, 204 and 206) to ensure that each channel 40, 42 and 44 was functioning properly when its command thread transmitted its thread majority opinion 22. Accordingly, each thread generates a qualified thread majority opinion for each channel. The qualified thread majority opinion for each channel is generally indicated by reference numeral 24 in Figure 4A. The qualified thread majority opinion for each channel is transmitted by the thread's MPU 54 over the private data bus 56 to the other threads of its own channel.

As seen in Figure 4A, each thread 46, 48 and 50 of its own channel receives the qualified thread majority opinions 24 generated by each thread. More specifically, each thread receives three sets of qualified thread majority opinions comprising: 1) the thread majority opinion of its own channel as qualified by each thread 46, 48 and 50; 2) the thread majority opinion of the other channel 1 as qualified by each of the threads 46, 48 and 50; and 3) the thread majority opinion of the other channel 2 as qualified by each of the threads 46, 48 and 50. The microprocessor 54 then performs cross-thread consolidation of each set of qualified thread majority opinions (blocks 208, 234 and 236) to determine a final thread majority opinion (generally designated by reference numeral 26 in FIG. 4A) for each channel 40, 42 and 44 indicating whether a majority of the threads of the channel have determined that an error has occurred in the particular TMR.

Finally, in block 250, each strand 46, 48 and 50 performs cross-channel consolidation of the final strand majority opinions 26 to determine a channel majority opinion 28 which indicates whether a majority of the channels have determined that the particular TMR has experienced a failure. In further embodiments of the present invention, the channel majority opinion is then processed by each strand to identify the type of failure the particular TMR is experiencing or to identify failures in other components of the wireline system 31.

Referring now to Fig. 4B, there is shown the determination of the thread majority opinion by one of the threads of the own channel. Because the functions performed by each thread 46, 48 and 50 of the channel are virtually identical and are performed simultaneously by each thread, only the functions performed by one thread of the channel will be described. In the following description, this thread will be referred to as the "own" strand" or "OL" and has been arbitrarily chosen to correspond to strand 46 of the own channel. Accordingly, strands 48 and 50 are arbitrarily referred to as the "other strand A" (OLA) and the "other strand B" (OLB), respectively. However, if one were to describe the functions as being performed by strand 48, strand 48 would be referred to as the "own strand" while strands 50 and 46 would be referred to as the "other strand A" and the "other strand B", respectively. Accordingly, one of ordinary skill in the art will understand from this description that if the functions depicted in Fig. 4B are performed in the own strand, virtually the same functions are performed simultaneously in the other strand A and the other strand B just as well. For ease of illustration, the functions performed by the other strand A and the other strand B are shown in phantom lines in Fig. 4B.

As previously noted, the LRUs 30 or 38 and the PFCs 40, 42 and 44 of the wireline system 31 communicate with the channels 40, 42 and 44 by sending messages 78 over a special data bus 33, 35 or 37 of the global communications bus 34. The messages are received by the interface 60 of each leg 46, 48 and 50 of each dedicated channel. Referring specifically to the dedicated leg of the dedicated channel, for each word leg 70 of the message 78' sent by the special TMR in the wireline system, error information relating to the word leg is stored in the error register 62, 63 or 64 of the interface 60 connected to the special bus on which the special TMR is currently transmitting. The error register stores a word of predetermined bit length, e.g. B. 16 bits in length, where each bit represents a specific type of error that occurs when a word string on the global communication bus 34 transmitted and inadvertently corrupted. Accordingly, if word string 70 contains errors, corresponding bits in the associated error register are set to 1, otherwise the bits are set to zero. The error register monitoring function shown in block 100 in Fig. 4 uses the error information stored in error registers 62, 63 and 64 to determine whether the particular TMR being monitored is suspected of transmitting message T8' with an excessive amount of errors. The logic employed by the present invention to make this determination is shown in more detail in Fig. 5.

The logic begins in Fig. 5 at block 102 where the MPU 54 of the own thread reads the error registers 62, 63 or 64 associated with the data bus 33, 35 or 37 over which the particular TMR transmits to obtain the error information associated with a word thread 70 of the message 78' transmitted by the particular TMR identified in the tag 72 of the word thread 70. At decision block 104, the logic determines whether an error has been detected in the word thread. In other words, the logic determines whether the error register bits associated with that word thread have been set to one. If the result is positive, the logic proceeds to block 106 where an error counter used to keep track of the number of errors in a message is incremented. However, if the result of decision block 104 is negative, the error counter is not incremented and the logic proceeds directly to decision block 108. In decision block 108, the logic determines whether the error information for the last word string 70 of message 78' has been read from the appropriate error register, that is, whether the error information from all word strings 70 in message 78', sent by the particular TMR has been processed. If not, the logic returns to block 102 where the error information associated with the next word string is read from the appropriate error register. The logic then repeats blocks 104 through 108 until the entire message has been processed.

If the result of decision block 108 is positive, i.e., if the error information for the last word string of the message has been read, the logic proceeds to decision block 110. In decision block 110, the logic determines whether the error counter has exceeded a first predetermined threshold, which is equivalent to an expected maximum number of errors allowed in a given period of time. It will be appreciated by those of ordinary skill in the art that the first predetermined threshold is established as a function of the various parameters of the wireline system, including the strict safety requirement that the numerical probability of a system failure be limited to less than 1.0E-10 or 1.0F-10 per flight hour. Accordingly, the first predetermined threshold can be varied in accordance with the parameters of the wireline system to achieve the desired level of integrity.

If the result of decision block 110 is positive, the logic continues to block 112 where a receive error signal for the own thread (RCVFOL) is set to true, indicating that the own thread suspects that the particular TMR is transmitting erroneous word threads at an excessive error rate. In other words, the own thread suspects that the particular TMR is experiencing an error or failure of some kind. However, if the result of decision block 110 is negative, the logic continues to block 114 where RCVFOL is set to false. is set, indicating that the own thread does not suspect an error in the particular TMR. It will be seen that RCVFOL is connected to the particular TMR monitored by the error register monitor and accordingly RCVFOL is also connected to the particular data bus 33, 35 or 37 on which the particular TMR is transmitting. In block 116, RCVFOL is stored in the memory of the MPU 54 in the own thread and sent to the other threads of the own channel so that each thread 46, 48 and 50 can determine for itself whether a majority of the threads of the own channel suspect that the particular TMR is transmitting erroneous word threads at an excessive rate.

Returning now to Fig. 4B, one of ordinary skill in the art will recognize that using the logic illustrated in Fig. 5, the other branch A and the other branch B of the own channel have generated their own RCVF signals, i.e., RCVFOLA and RCVFOLB, and sent them to the own branch from the own channel over the private data bus 56. Accordingly, the own branch receives RCVFOLA and RCVFOLB from the other branch A and the other branch B, respectively, and retrieves the RCVFOL signal from the memory of its MPU. In block 122, the MPU 54 of the own channel performs cross-string consolidation of the three RCVF signals generated by the own channel strings 46, 48 and 50 to form a string majority opinion for the own channel indicating whether a majority of the own channel strings suspect that the particular TMR is transmitting erroneous word strings at an excessive rate, i.e., that the particular TMR is experiencing a failure.

The logic applied by the MPU 54 of the own strand to perform the cross-strand consolidation of the The logic for executing RCVF signals is shown in more detail in Figure 6. The logic begins in decision block 124 where it determines whether RCVF has been set to true for at least two threads in the own channel. If the result is positive, the logic proceeds to block 126 where a thread majority opinion (LMO) is set to true, indicating that at least two threads of the channel suspect that the particular TMR is currently transmitting erroneous word threads at an excessive rate. In other words, at least two threads of the channel suspect a failure in the particular TMR and thus have a "bad opinion" of the particular TMR. However, if the result of decision block 124 is negative, at least two threads have determined that the particular TMR is not currently experiencing a failure. Accordingly, LMO is set to false and the logic proceeds to decision block 130. At decision block 130, the logic determines whether LMO has been set to true. If so, the logic proceeds to block 132 where a bad opinion counter is incremented. The bad opinion counter monitors the number of times at least two threads of the home channel have a bad opinion about the particular TMR. However, if the result of block 130 is negative, the bad opinion counter is decremented and the logic proceeds to decision block 136.

In decision block 136, the logic determines whether the bad opinion counter has exceeded a second predetermined threshold. The second predetermined threshold is equivalent to an expected maximum number of times that a majority of the threads can have a bad opinion about the particular TMR. In the preferred embodiment, the second predetermined threshold is also determined as a function of various parameters of the wireline system, including the stringent security requirements set forth above. In this way, the level of integrity in the system is further enhanced. If the result of decision block 136 is positive, the logic proceeds to block 138 where a confirmed thread majority opinion (also referred to as a gray own channel error flag GFFOC) is set to true, indicating that at least two threads of the own channel have persistently suspected that the particular TMR is transmitting erroneous word threads at an excessive rate. In other words, a failure of some type in the wireline system 31 is confirmed by the persistent bad opinion of a majority of threads of the own channel. However, if the result of decision block 136 is negative, the logic proceeds to block 140 where GFFOC is set to false, indicating that a majority of the threads in the own channel have determined that a failure has not occurred in the particular TMR because a majority of the threads have not persistently suspected a failure. Since the possible failure conditions that caused the own thread to suspect a failure have not persisted, a compromise conviction of the particular TMR is avoided. Accordingly, the availability of that particular TMR in the wireline system 31 is maintained. Further, it will be apparent to one of ordinary skill in the art that the persistence requirement for "bad opinions" also accommodates the asynchronous operation of the three channels. Finally, someone of ordinary skill in the art will recognize that if one strand is currently in disagreement with the other two, that strand will eventually or eventually follow the majority opinion.

Once the affirmed majority opinion for the own channel, GFFOC, is determined, it must be sent to the other channel 1 and the other channel 2 of the wireline system 31 for use in other functions. Accordingly, the logic proceeds to decision block 142 where the logic determines if the own branch is the command branch of the channel. If so, the logic proceeds to block 144; where the own branch MPU 54 sends GFFOC to the other branch A, the other branch B, the other channel 1 and the other channel 2 of the wireline system 31 over the global communications bus 34. If the own branch is not the command branch, the logic proceeds to block 146 where the own branch MPU 54 simply stores GFFOC in memory for other use. Since the other thread A and the other thread B perform this function simultaneously, it can be seen that as long as the command thread of the own channel (either the other thread A or the other thread B) sends GFFOC to the other channels in block 144.

Although GFFOC is sent through the own channel command thread, the own thread must determine if it is the only one that has a bad opinion about the particular TMR. If so, it is possible that the own thread is currently experiencing a failure rather than the particular TMR that it is blaming. Consequently, in decision block 148, the logic determines if the own thread is the only thread for which RCVF has been set true for the particular TMR, that is, that RCVFOL has been set true and RCVFOLA and RCVFOLB have been set false. If the result is positive, the logic proceeds to block 150 where a own thread receive error signal (OWNF) for the particular TMR is set true, indicating that the own thread may be currently experiencing a failure. However, if the result of decision block 148 is negative, the own leg is not currently experiencing a failure and OWNF is set to false in block 152. As mentioned above, RCVFOL is associated with the particular TMR and the particular data bus 33, 35, or 37 over which that particular TMR transmits. Accordingly, one of ordinary skill in the art will appreciate that OWNF is equally associated with the particular TMR and the particular data bus 33, 35, or 37 over which the particular TMR transmits. As described next, OWNF is used by the own leg to make a PFC leg failure determination which confirms that the own leg of the own channel is currently experiencing a failure.

Referring to Fig. 4B, the own thread MPU 54 performs a PFC thread fault determination in block 154 to determine if the own thread is currently experiencing a fault. The logic used by the MPU 54 to perform the PFC thread fault determination is shown in more detail in Fig. 7. If the own thread is alone in suspecting that a fault exists in three or more TMRs transmitting on a particular data bus 33, 35 or 37, it is most likely that the own thread is currently experiencing a fault. Accordingly, beginning in decision block 156, the logic determines whether the own thread suspects that at least three TMRs transmitting on the left bus 33 have a failure while the other threads have not suspected the same failures, i.e., whether OWNF has been set to true with respect to three or more TMRs transmitting on the left data bus 33. If so, a left bus failure discrete (LBF) is set to true in block 158, indicating that the own thread is alone in having at least three TMRs on the left bus in the suspecting a fault or failure. If the result of decision block 156 is negative, LBF is set to false in block 160, indicating that the own thread is not alone in suspecting at least three TMRs on the left bus to have a fault or failure.

The logic then proceeds to decision block 162 where it determines whether the own thread is alone in suspecting at least three TMRs on the center bus 35 to have a fault or failure while the other threads did not suspect the same faults or failures. If so, the center bus fault discrete (CBF) is set to true in block 164. If not, the CBF is set to false in block 166. Similarly, the logic proceeds to decision block 168 where it determines whether the own thread is alone in suspecting at least three TMRs on the right bus 37 to have a fault or failure while the other threads did not suspect the same faults or failures. If so, the right bus fault discrete (RBF) is set to true in block 170. If not, the RBF discrete is set to false in block 172.

After LBF, CBF and RBF have been set, the logic proceeds to block 174 where it determines if any of LBF, CBF or RBF has been set to true. In other words, the logic determines if the own leg is the only leg in the channel that accuses at least three TMRs transmitting on a particular bus 33, 35 or 37 of having an error or failure. If so, an own leg error discrete (OLF) is set to true in block 176, thereby confirming the probability of an error or failure on the own leg. If the result of decision block 174 is negative, OLF is set in block 178. Block 178 is set to false. In decision block 180, the logic determines whether OLF has been set to true, and if so, the failure counter is incremented in block 182. The failure counter keeps track of the number of times the own thread has been alone in accusing three or more TMRs on a particular data bus of a failure. However, if OLF is false, the own thread is not the only thread making such an accusation, and accordingly the failure counter is decremented in block 184. In decision block 186, the logic determines whether the failure counter has exceeded a third predetermined threshold equivalent to a maximum number of times the own thread can accuse three or more TMRs on a particular bus of a failure. As described above in connection with the second predetermined threshold, the third predetermined threshold is established as a function of various system parameters so that a high level of integrity is maintained in the wire-controlled system.

If the result of decision block 186 is affirmative, the own thread is alone in persistently faulting three or more TMRs on a particular data bus and, accordingly, it is most likely that the own thread is currently experiencing a fault. Such persistent mismatch by the own thread must be handled before another thread of the own channel experiences a fault and joins the own thread to produce an incorrect asserted thread majority opinion for the own channel. Consequently, in block I88, a thread receive failure signal (LRCVF) is set to true, indicating that the own thread is experiencing a failure. As shown in Fig. 4B, LRCVF is then used by other PFC functions in block 192, such as the PFC thread redundancy management function (not the subject of this invention and thus not shown), which uses LRCVF to lock and restart the own thread as necessary and prevent the own thread from establishing an erroneous asserted thread majority opinion GFFOC. However, if the result of decision block 186 is negative, the own thread is probably not experiencing a failure and LRCVF is set to false in block 190, again avoiding a threat rejection from an aircraft component and promoting system availability.

Referring now to Figures 4A and 4C, it can be seen that the threads 48 and 50 generate and transmit their own asserted thread majority opinions GFFOC1 and GFFOC2 as described above in connection with the own thread. Accordingly, each own channel thread 46, 48 and 50 receives GFFOC from its own channel, GFFOC1 from the other channel 1 and GFFOC2 from the other channel 2 over the global communications bus 34. The next function to be performed by the own channel thread is to qualify each of the received GFF signals to ensure that the channel, i.e., the PFC, transmitting the particular GFF is not currently experiencing a failure. Accordingly, the MPU 54 qualifies GFFOC, GFFOC1 and GFFOC2 as shown in blocks 194, 204 and 206. The logic used by the MPU 54 to qualify GFFOC is shown in Figure 8. Those of ordinary skill in the art will recognize that virtually the same logic is used by the MPU 54 from its own thread in blocks 204 and 206 to qualify both to qualify or label both GFFOC1 and GFFOC2. Accordingly, the logic used in blocks 204 and 206 will not be discussed in detail.

Referring to Figure 8, the logic begins at decision block 196 where a test is failed to determine whether a signal designated PFC FRESHOC associated with the own channel has been set true. As discussed in more detail below, PFC FRESHOC indicates whether the own channel is still actively sending messages 78 to the other channel 1 and the other channel. If so, the own channel is still active and processing of GFFOC can continue. As a result, the logic will proceed to block 198 where the own leg MPU 54 sets a qualified leg majority opinion (GFF(OC)(OL)) equal to the asserted (but previously unqualified) leg majority opinion GFFOC. In block 200, the MPU 54 of the own strand sends GFF(OC)(OL) to the other strand A and the other strand B of the own channel via the private data bus 56.

If the result of decision block 196 is negative, i.e., if PFC FRESHOC is false, the own channel is not actively sending messages 78 to the other channels. Accordingly, it is most likely that the own channel is currently experiencing an error or failure. As a result, the logic proceeds to block 202 where the unqualified and now unusable GFFOC signal is stored in the memory of the MPU 54 so that it can be used by other PFC functions to shut down the own channel if necessary.

After GFFOC, GFFOC1 and GFFOC2 have been qualified or marked by their own strand in blocks 194, 204 and 206 the qualified or marked string majority opinions GFF(OC)(OL), GFF(OC1)(OL) and GFF(OC2)(OL) for each channel are sent to the other strings of its own channel via the private data bus 56. As shown in phantom lines in Fig. 4C, the other thread A and the other thread B also qualify GFFOC, GFFOC1 and GFFOC2 in blocks 194, 204 and 206. Accordingly, the other thread A sends qualified thread majority opinions GFF(OC)(OLA), GFF(OC1)(OLA) and GFF(OC2)(OLA) and the other thread B sends qualified thread majority opinions GFF(OC)(OLB), GFF(OC1)(OLB) and GFF(OC2)(OLB) to the own thread via the private data bus 56. As a result, each thread 46, 48 and 50 of the own channel receives a set of qualified thread majority opinions for each channel. For example, the own thread receives the first set, which includes GFF(OC)(OL), GFF(OC)(OLA), and GFF(OC)(OLB); the second set, which includes GFF(OC1)(OL), GFF(OC1)(OLA), and GFF(OC2)(OLB); and the third set, which includes GFF(OC2)(OL), GFF(OC2)(OCA) (locations), and GFF(OC2)(OLB).

Next, the MPU 54 of the own strand performs a cross-strand consolidation of the qualified strand majority opinions for each channel to determine a final strand majority opinion for each channel 40, 42 and 44 of the wire-controlled system 31. More specifically, in block 208, a cross-strand consolidation is performed over the first set of qualified strand majority opinions for the own channel. Similarly, in block 234, a cross-strand consolidation is performed over the second set of qualified strand majority opinions for the other channel 1, while in block 236, a cross-strand consolidation is performed over the third set of qualified strand majority opinions. for the other channel 2. The logic applied by the own-string MPU 54 to perform the cross-string consolidation of the first set of qualified string majority opinions for the own channel is shown in more detail in Fig. 9. However, it will be readily apparent to those of ordinary skill in the art that virtually the same logic is applied by the own-string MPU 54 to perform the cross-string consolidation of the second and third sets of qualified string majority opinions, i.e., the qualified string majority opinions from both the other channel 1 and the other channel 2. Accordingly, the logic applied in blocks 234 and 236 will not be discussed in detail.

As shown in Figure 9, the logic of block 208 begins in decision block 210 where a test is performed to determine if the qualified thread majority opinion of at least two threads in the own channel has been set to true, that is, that at least two of the three qualified majority opinions GFF(OC)(OL), GFF(OC)(OLA) and GFF(OC)(OLB) are true. If the result is positive, the logic proceeds to block 212 where a temporary thread majority opinion (LMO') signal is set to true, indicating that even after qualifying, at least two threads of the channel still suspect that the particular TMR is sending erroneous word threads at an excessive rate. In other words, at least two threads of the channel now have a "qualified bad opinion" about the particular TMR. However, if the result of decision block 210 is negative, LMO' is set to false in block 214, indicating that after qualifying or marking the GFF signals the majority of the threads in the own channel no longer suspect the particular TMR is out of order. In decision block 216, the logic determines whether LMO' has been set to true. If so, a qualified bad opinion counter is incremented in block 218. The qualified bad opinion counter is used to determine whether a majority of threads in the own channel have had a sustained qualified bad opinion about the particular TMR, thus avoiding a compromise rejection of the particular TMR and maintaining system availability. However, if the result of decision block 216 is negative, the qualified bad opinion counter is decremented in block 220 because the majority of the threads do not suspect the particular TMR is out of order.

In decision block 222, the logic determines whether the count of qualified bad opinions has exceeded a third predetermined threshold, which is equivalent to a maximum number of times that a majority of the threads in the own channel can have a qualified bad opinion about the particular TMR. In the preferred embodiment, the predetermined threshold is also determined as a function of various parameters of the wire-controlled system, including the stringent security requirement stated above. Accordingly, the level of integrity in the multi-channel system is once again improved to a higher level. If the result of decision block 222 is positive, a final thread majority opinion (also referred to as a thread consolidation signal LCSac) is set to true, indicating that at least two threads of the own channel have persistently determined that the particular TMR is transmitting erroneous word threads 70 at an excessive rate even after qualifying the GFF signals. In other words, the final thread majority opinion of the own channel is that the particular TMR is currently experiencing a failure. However, if the result of decision block 222 is negative, the logic proceeds to block 226 where LCSOC is set to false, indicating that a majority of the threads in the own channel have determined that the particular TMR is not currently experiencing a failure. In any event, those of ordinary skill in the art will recognize that the third thread of the own channel which does not share the majority opinion is expected to follow the final majority opinion of the own channel. Again, those of ordinary skill in the art will recognize that a threat failure has been avoided and system availability maintained.

Before LCSOC can be used for any other purpose, the own leg must determine if it is the only leg blaming the particular TMR. Consequently, after LCSOC is set to true or false, the logic proceeds to decision block 228 where it determines if the own leg is the only leg of the channel for which the qualified leg majority opinion for the particular TMR has been set to true, i.e., whether GFF(OC)(OL) has been set to true but GFF(OC)(OLA) and GFF(OC)(OLB) have been set to false. If the result is positive, the logic proceeds to block 230 where a qualified own leg receive failure (OWNF'OC) is set to true. However, if the result of decision block 230 is negative, OWNF'OC is set to false. As shown in Figure 4C, OWNF'OC is determined by the PFC leg failure function. or failure determination in block 238 to determine whether the channel's own leg is currently experiencing a fault or failure.

The logic used to make the PFC string failure determination in block 238 is virtually the same as the logic used to make the PFC string failure determination in block 154 and is shown in detail in FIG. 7. Accordingly, the logic used to make the PFC string failure determination using OWNF'OC will not be described in detail. As shown in FIG. 4C, if the own string is currently experiencing a failure, a qualified string receive failure signal (LRCVF'OC) is set to true. Otherwise, LRCVF'OC is set to false because the own string is not currently experiencing a failure. LRCVF'OC is then overridden by other PFC functions in block 240, such as OWNF'OC. B. the PFC string redundancy management function (not shown and not a subject of this invention) is used to lock and restart its own string when necessary.

As can be seen from the foregoing description, the cross-string consolidation into the qualified string majority opinions from the other channel 1 (block 234) produces a final string majority opinion for the other channel 1 (LCSOC1) and a qualified receive failure (OWNF'OC1) of the own string using virtually the same logic as described above. Similarly, the cross-consolidation of GFF(OC2)(OL), GFF(OC2)(OLA) and GFF(OC2)(OLB) occurring in block 236 produces a final string majority opinion (LCSOC2) for the other channel 2 and a qualified receive failure of the own string (OWNF'OC2). OWNF'OC1 and OWNF'OC2 are then further processed into the blocks 242 and 244 and processed in blocks 246 and 248 as shown. Once the final strand majority opinions have been determined by the MPU 54 for its own strand for each channel 40, 42 and 44, cross-channel consolidation of the final strand majority opinions is performed in block 250 to determine a channel majority opinion indicating whether a majority of the channels have detected a failure in the particular TMR.

The logic employed in block 250 to perform cross-channel consolidation of LCSOC, LCSOC1, and LCSOC2 is shown in Figure 10. The logic begins in decision block 252 where it determines whether the final trunk majority opinion associated with the particular TMR has been set true for at least two channels in the wire-controlled system 31. In other words, the logic determines whether at least two channels have a bad channel opinion about the particular TMR. If the result of decision block 252 is positive, a channel majority opinion (CMO) is set true, indicating that at least two channels of the wire-controlled system 31 have determined that the particular TMR is currently experiencing a failure of some type. However, if the result of decision block 252 is negative, CMO is set to false in block 256, indicating that the majority of channels have determined that the particular TMR is not faulty. In decision block 258, the logic determines whether CMO has been set to true. If so, a bad channel opinion counter is incremented. See block 260. The bad channel opinion counter monitors how consistently a majority of channels have formed a bad channel opinion about the particular TMR so that a compromise rejection is avoided and system availability is promoted. However, if the result of decision block 258 is negative, the bad channel statement counter is decremented because no failure is suspected in the particular TMR. See block 262.

Referring to decision block 264, the logic determines whether the bad channel opinion count has exceeded a fourth predetermined threshold, which is the equivalent of a maximum number of times a majority of the channels can have a bad channel opinion about the particular TMR. The fourth predetermined threshold is also determined as a function of various parameters of the wire-controlled system, including the strict safety requirement set as above, so that the level integrity of the system is further enhanced. If the result of decision block 264 is positive, then in block 266 a TMR validity signal (TXVLD) is set to false, indicating that a majority of the channels of the wire-controlled system 31 have had a persistent bad opinion about the particular TMR. In other words, a failure of some type in the particular TMR is confirmed by a majority of the channels. However, if the result of decision block 264 is negative, TXVLD is set to true in block 268, indicating that a majority of the channels of the wireline system 31 have determined that the particular TMR is not currently experiencing a failure. Again, it will be readily apparent to one skilled in the art that this process avoids a compromised rejection of the particular TMR. TXVLD is then stored in the memory of the MPU 54 for use with other PFC functions, as shown in block 270, such as the PFC input signal management function, which allows the use of data from the particular would exclude TMR if TXVLD is false for the specific TMR.

As illustrated in Figure 4C, cross-channel consolidation is performed synchronously in each strand 46, 48, and 50 of the own channel. As a result, each strand of the own channel generates a TXVLD signal associated with the particular TMR. The state of TXVLD is expected to be the same among strands within a channel.

Returning now to Fig. 4C, the TXVLD signal determined using cross-channel consolidation in block 250 is then used by a number of other functions to determine whether the TMR is currently experiencing an intermittent or constant failure, or whether the global communications bus 34 is currently experiencing the failure. In block 272, the home branch MPU 54 performs a data bus monitoring function. The logic used by the MPU 54 to perform this function is shown in more detail in Fig. 11. The logic begins in decision block 274 where it determines whether TXVLD has been set to false for more than two TMRs transmitting on a particular bus, either the left bus 33, the center bus 34, or the right bus 37. If so, the TXVLD has probably been set to false due to an intermittent or permanent failure of the global communications bus 34. As a result, a bus validity signal (BVLD) is set to false in block 276, indicating that the particular data bus 33, 35, or 37 on which the particular TMR is transmitting is currently experiencing a failure. Otherwise, the BLVD is set to true in block 278. In block 280, the BLVD is stored in the memory of the own-string MPU 54 so that it can be used by other PFC functions, such as the PFC input signal management function. which will invalidate all messages sent over the faulty data bus 33, 35, or 37 if BVLD has been set to false for an LRU transmitting on a particular data bus.

Referring again to Figure 4C, after the data bus monitor function is performed in block 272, the own-string MPU 54 performs an active TMR monitor function in block 284. The logic used by the MPU to perform this function is shown in more detail in Figure 12. The logic begins in decision block 286, where it determines whether TXVLD for the particular TMR has changed from a previous true value to a current false value. If so, a TXVLD transition counter is incremented in block 288. The TXVLD transition counter keeps track of the number of times TXVLD changes from true to false. If the result of decision block 286 is negative, the TXVLD transition counter is not incremented and the logic simply continues to decision block 290:

In decision block 290, the logic determines whether an active transmit validity signal (TMRVLD) for the particular TMR has changed from a previous true value to a current false value. As described below, TMRVLD indicates whether the particular TMR is still actively transmitting messages 78 on its own channel. If the particular TMR is not, TMRVLD must be set to false. Otherwise, TMRVLD must be set to true. If the result of decision block 290 is positive, a TMRVLD transition counter is incremented in block 292. The TMRVLD transition counter keeps track of the number of times TMRVLD changes from true to false. If the result of decision block 290 is negative, the TMRVLD Transition counter is not incremented and the logic proceeds directly to decision block 294.

In decision block 294, the logic determines whether either the TXVLD or TMRVLD transition count is greater than a fifth predetermined threshold. The fifth predetermined threshold is equivalent to a maximum number of transitions allowed in a given period of time. It can be seen that the frequent true to false transition of TMRVLD within an aircraft flight indicates the existence of an intermittent fault or failure in the particular TMR, possibly due to a loose connection with the global communications bus 34. On the other hand, a frequent transition of TXVLD indicates an intermittent fault or failure in the global communications bus 34. If the result of decision block 294 is positive, a transmitter okay signal (TXOK) is set to false in block 296. In block 298, the MPU 54 of its own strand locks any data associated with the particular TMR into its memory and use of the TMR data is suspended for the remainder of the flight. However, if the result of decision block 294 is negative, the logic continues to block 300 where TXOK is set to true for the particular TMR.

Returning to Fig. 4C, once TVXLD, BVLD and TXOK have been determined by the own strand, the MPU 54 uses the signals to perform a freshness monitor function in block 304. The freshness monitor function determines whether each channel 40, 42 and 44 is still actively sending the messages 78 to the other channels of the wire-controlled system 31 and whether the particular TMR is still actively sending messages to the own channel. The logic used by the freshness monitor function is illustrated in Fig. 13. As can be seen from the following As will be better appreciated from the description of Fig. 13, the logic shown in blocks 305 through 315 determines whether each channel 40, 42 and 44 is still actively sending messages, while the logic shown in blocks 316 through 320 determines whether the particular TMR is still actively sending messages.

The logic of Figure 13 begins in decision block 305 where it determines whether the particular TMR being monitored is a particular PFC. If so, the logic proceeds to block 306 where it determines whether any of TXVLD, BVLD and TXOK associated with the particular PFC have been set to false. If so, the particular PFC may be experiencing a fault. As a result, a PFC FRESH signal indicating a possible fault is set to false in block 312. However, if the result of decision block 306 is negative, the logic proceeds to decision block 308 where it determines whether the particular PFC has sent a message 78 to either of the other two channels within a predetermined time interval. If so, PFC FRESH is set to true in block 310, indicating that the particular PFC is still actively sending messages. If the result of decision block 312 is negative, PFC FRESH is set to false in block 308, indicating that the particular PFC may be inactive. Once PFC FRESH has been set, the logic ends in block 321. As will be readily apparent to those skilled in the art and others from the preceding discussion, if the particular PFC being monitored is the own channel, PFC FRESH represents the active status of the own channel and may be specifically identified as PFC FRESHOC. Similarly, if the particular PFC being monitored is the other channel 1 or the other channel 2, PFC FRESHOC1 or PFC FRESHOC2 respectively represents the status of the channel.

If the result of decision block 305 is negative, the special TMR is actually a special LRU rather than a special PFC. In this case, the logic bypasses blocks 306 through 312 and proceeds to blocks 314 through 320, which determine whether the special LRU is still actively sending messages to its own channel over global communications bus 34. More specifically, in decision block 314, the logic determines whether any of TXVLD, BVLD, and TXOK associated with the special LRU have been set to false. If so, the special LRU may be experiencing a failure. As a result, an LRU FRESH signal, indicating a possible failure, is set to false in block 320. However, if the result of decision block 314 is negative, the logic proceeds to decision block 316 where it determines whether the own thread has received a message 78 from the particular LRU within the predetermined time interval. If so, LRU FRESH is set to true in block 318, indicating that the particular LRU is still in communication with the own channel. Otherwise, LRU FRESH is set to false in block 320, indicating that the particular LRU may be completely inactive. The freshness monitoring function then ends in block 321.

As shown in Figure 4C, once the freshness monitoring function in block 304 has ended, PFC FRESH and LRU FRESH are used by other PFC functions. More specifically, PFC FRESH in block 322 is used by other PFC functions such as PFC input signal management, which may shut down a channel when it is not actively sending messages 78. The special PFC FRESH signals PFC FRESHOC, PFC FRESHOC1 and PFC FRESHOC2 are also used by the own thread MPU 54 to set the thread majority statements GFFOC, GFFOC1 and GFFOC2 in blocks 194, 204 and 206. Both PFC FRESH and LRU FRESH are used by the MPU 54 of the own strand to perform an inactive TMR monitor function in block 324, wherein the inactive TMR monitor function confirms whether the particular PFC or LRU is completely inactive.

The logic used by the own-line MPU 54 to perform the inactive LRU monitoring function in block 324 is shown in more detail in Figure 14. The logic begins in decision block 325 where it determines whether the particular TMR being monitored is a particular PFC. If so, the logic proceeds to decision block 326 where it determines whether PFC FRESH for the particular PFC has been persistently set to false, i.e., whether PFC FRESH has been set to false for a predetermined time interval. In the preferred embodiment of the present invention, the duration of the predetermined time interval is approximately 2.5 minutes. Those of ordinary skill in the art will recognize that the time interval can be varied according to parameters of the wireline system as necessary to achieve the desired level of integrity. If PFC FRESH has been set to false for more than 2.5 minutes, the logic determines that the particular PFC is most likely inactive. As a result, the active transmitter valid signal (TMRVLD) mentioned above is set to false in block 327. Otherwise, TMRVLD is set to true in block 328.

If the result of decision block 325 is negative, the special TMR is actually a special LRU rather than a special PFC. In this case, the logic bypasses decision block 326 and proceeds to decision block 330. In decision block 330, the logic determines whether LRU FRESH for the particular LRU has been set to false for a sustained period of time, ie, whether LRU FRESH has been set to false for a period of time, such as 2.5 minutes. If LRU FRESH has been set to false for more than the period of time, the logic determines that the particular LRU is in all probability inactive. As a result, the above-mentioned active transmitter valid signal (TMRVLD) is set to false in block 327. Otherwise, TMRVLD is set to true in block 328.

As described above, TMRVLD is used by the Active TMR Monitor function 284 to determine whether the particular transmitter is experiencing an intermittent failure, as opposed to being completely inactive. A false value indicates that the particular TMR is likely to have a broken or loose connection to the data bus 34. However, if TMRVLD changes from true to false frequently, it is possible that the particular TMR is just experiencing an intermittently broken or loose connection to the communication bus.

Those of ordinary skill in the art will recognize from Figures 4A, 4B and 4C that virtually the same functions as described above are performed by each leg 46, 48 and 50 of each channel 40, 42 and 44 in the wire-controlled system. Thus, ultimately, each leg of each channel identifies failures in each TMR, i.e., each LRU 30 or 38, each PFC 40, 42 and 44, each leg 46, 48 and 50 and each data bus 33, 35 and 37 of the wire-controlled system 31. By means of the present invention, each leg of each channel also avoids hazardous rejection of these aircraft components, thus providing a high level of safety in the wire-controlled system. level of integrity is maintained and aircraft component availability is promoted.

Although the presently preferred embodiment of the present invention has been illustrated and described, it will be recognized that various changes may be made within the scope of the appended claims without departing from the definition of the invention as defined in the claims. For example, it will be recognized by those of ordinary skill in the art that although the present invention has been described as being applied by a wire-controlled system having three redundant channels, the present invention may also be used by systems having more than three channels. Similarly, the present invention may be used in systems wherein each channel may have more than three strands. In such cases, the definition of the majority opinion, i.e., whether a majority opinion constitutes half of the strands when there are an even number of strands or whether it requires a single majority, will be decided by design specifications. It is further understood that the present invention may also be applied to any multi-channel system and accordingly should not be limited to wire-guided or -controlled flight systems or to any other type of avionics system.

Claims (15)

1. A method for determining failures in a control system (31), wherein the control system comprises a global bus (34) comprising a plurality of data buses (33, 35, 37) and a plurality of transmitters coupled to the global bus for transmitting data over the global bus, wherein the plurality of transmitters comprises a plurality of line-replaceable units (30, 38) and a plurality of computer channels (40, 42, 44), each channel including a plurality of strands (46, 48, 50) coupled by a private bus (56), one strand of which comprises a command strand for transmitting messages from the channel over the global bus, each strand of each channel is coupled to each data bus and each line-replaceable unit is coupled to one of the data buses, the method comprising: (a) for each transmitter, each channel, generating a thread majority opinion indicating whether a majority of the threads of the channel have detected an error or failure in the transmission of data by the transmitter over the global bus; (b) for each computer channel, sending or transmitting the string majority opinion to the other channels via the global bus; and (c) for each leg of the channel, generating a channel majority opinion for each transmitter as a function of the leg majority opinions, the channel majority opinions indicating whether a majority of the channels report the said failure in transmission or transmission of data by the transmitter or transmitter via the global bus. 2. The method of claim 1, wherein generating a thread majority opinion comprises: (a) generating an error signal, the state of which indicates whether data transmitted by the transmitter over the global bus has excessive errors; (b) sending the error signal to the other strands of the channel via the channel’s private bus; and (c) Determine whether a majority of the threads have persistently generated an error signal, the state of which indicates whether data transmitted by the transmitter over the global bus has excessive errors. 3. A method according to claim 2, wherein each channel qualifies its thread majority opinions by: (a) receiving the thread majority opinions from each channel via the global bus; and (b) for each strand majority opinion received, (i) determining whether the channel is experiencing a transmission failure by evaluating a channel freshness signal indicating whether the channel from which the thread majority opinion was received is active; (ii) if the channel is not currently experiencing a transmission error, generating a qualified or designated strand majority opinion for the channel if the majority of the strands of the channel have detected an error or failure in the transmitter or transmitter; and (iii) after the qualified or designated majority opinion for the channel has been generated, sending the qualified or designated majority opinion for the channel to the other threads of the channel over the private bus of the channel. 4. The method of claim 3, further comprising each channel generating a final strand majority opinion indicating whether a majority of the strands of the channel have continued to detect the failure in the transmitter after qualifying the strand majority opinion for the channel by: (a) receiving a set of qualified or designated strand majority opinions from each channel, each channel's set comprising the channel's qualified or designated strand majority opinion as qualified or designated and transmitted by each strand of the channel; and (b) for each channel set of qualified strand majority opinions, generating a final strand majority opinion of the channel as a function of the channel set of qualified strand majority opinions, wherein generating the final strand majority opinion of the channel as a function of the channel set of qualified strand majority opinions further comprises determining whether a majority of the strands have consistently generated a qualified strand majority opinion indicating that the transmitter is experiencing a failure. 5. The method of claim 4, wherein generating a channel majority opinion further comprises: for each leg of the channel, determining whether a majority of the channels have consistently generated a final majority opinion indicating that the transmitter is experiencing a failure, further comprising generating a bus validity signal as a function of the channel majority opinion, wherein the bus validity signal indicating whether the data bus to which the transmitter is connected is experiencing a failure, and further comprising generating a satisfactory transmitter signal as a function of the channel majority opinion and an inactive transmitter signal indicating whether the transmitter is inactive, the satisfactory valid signal indicating whether the transmitter is experiencing an intermittent failure. 6. The method of claim 5, further comprising generating the channel freshness signal as a function of the majority channel statement, the bus validity signal and the satisfactory transmitter signal by: - Determine whether the transmitter or transmitter is a channel ; - if the transmitter is a channel, determining whether any of the majority channel statement, the bus validity signal, or the satisfactory transmitter signal indicates that a failure has been detected; and - determining whether the transmitter has sent a message within a predetermined time interval if a failure has been detected, further comprising generating a line-replaceable-unit-freshness signal as a function of the majority-channel-statement, the bus-validity signal and the satisfactory transmitter signal by: - if the transmitter is not a channel and is accordingly a line replaceable unit, determining whether any of the channel majority opinion, the bus validity signal or the satisfactory transmitter Signal indicates that an error or failure has been detected; - determining whether the line has received a message from the transmitter within the predetermined time interval when an error or failure has been detected; and further comprising generating the inactive transmitter signal as a function of the channel freshness signal and the line replaceable unit freshness signal by: - Determine whether the transmitter or transmitter is a channel ; - if the transmitter is a channel, determining whether the channel freshness signal indicated that the transmitter has not transmitted a message within a predetermined time interval; - if the transmitter is a line-replaceable unit, determining whether the line-replaceable unit signal indicated that the branch did not receive a message from the line-replaceable unit within the predefined time interval, wherein generating the satisfactory transmitter signal as a function of the channel majority opinion and the inactive transmitter signal further comprises: - Determining whether the channel majority opinion continuously changes from indicating that the transmitter or transmitter is not currently experiencing a fault to indicating that the transmitter or transmitter is currently experiencing a fault; and - Determine whether the inactive transmitter or transmitter signal changes persistently from indicating that the transmitter or transmitter is active to indicating that the transmitter or transmitter is active. 7. The method of claim 2, wherein generating a thread majority opinion for the channel further comprises generating a thread failure signal indicating whether the thread may be experiencing a failure if only one thread in the channel has generated an error signal indicating that the transmitter is currently transmitting a message over the global bus that has excessive errors. 8. The method of claim 7, further comprising confirming that the string has experienced a failure by determining whether the string has been generating persistent string failure signals indicating that the string may be experiencing a failure. 9. The method of claim 4, wherein generating a final thread majority opinion for the channel further comprises generating a final thread failure signal indicating whether the thread may be currently experiencing a failure if only one thread in the channel has generated a failure signal indicating that the transmitter is currently transmitting a message over the global bus that has excessive errors, further comprising confirming that the thread has experienced a failure by determining whether the thread has persistently generated final thread failure signals indicating that the thread may be currently experiencing a failure. 10. Multi-channel system (31) for monitoring and identifying faults experienced by elements of the system, wherein the multi-channel system comprises: (a) a global bus (34) comprising a plurality of data buses (33, 35, 37); (b) a plurality of line-replaceable units (30, 38) coupled to the global bus, that each line-replaceable unit is connected to one of the data buses, each line-replaceable unit forming a transmitter that sends or transmits messages over the global bus; and (c) a plurality of computer channels (40, 42, 44) coupled to the global bus, each computer channel also forming a transmitter that transmits messages over the global bus, each channel including a plurality of threads (46, 48, 50) coupled by a private bus (56), each thread including a power supply (52), a processor (54) and an interface (60) to the global bus, a thread (40) of each channel including a command thread that transmits messages over the global bus, and each computer channel detecting failures in the multi-channel system such that: for each transmitter connected to the global bus, the processor generates a thread majority opinion from each strand of the channel indicating whether a majority of the strands of the channel have detected an error or failure in the transmission of data by the transmitter over the global bus, and after transmitting the thread majority opinions from each channel over the global bus to the other channels, generates a channel majority opinion associated with the transmitter indicating whether a majority of the channels have detected an error or failure in the transmission of data by the transmitter over the global bus. 11. A multi-channel system according to claim 10, wherein the processor generates the channel majority opinion for the transmitter for each leg of the channel with: - generating means for generating a strand majority opinion for the channel indicating whether a majority of the strands of the channel have detected an error or failure in the transmitter or transmitter which communicates via the global bus; - wherein the command thread is capable of communicating the thread majority opinion to the other computer channels over the global bus via the command thread interface; - receiving means for receiving the string majority opinion generated by the processor of the instruction string from each of the other channels; and - generating means for generating the channel majority opinion as a function of the thread majority opinion generated by the instruction thread of each channel, wherein the processor of each thread of the channel generates a thread majority opinion of the channel with: - generating means for generating an error signal, the state of which indicates whether the data transmitted by the global bus have excessive errors; - transmission means for transmitting the error signal to the other strands of the channel via the private bus of the channel; and - determining means for determining whether a majority of the threads have persistently generated an error signal, the state of which indicates whether the data transmitted by the transmitter over the global bus has excessive errors, wherein the processor of each thread qualifies the thread majority opinion for each channel before generating the channel majority opinion; - receiving means for receiving the string majority opinion from each channel via the global bus; and - for each strand majority opinion received, (i) determining means for determining whether the channel is currently experiencing a transmission error by evaluating the channel freshness signal indicating whether the channel from which the trunk majority opinion was received is active; (ii) when the channel is not experiencing a transmission error, generating means for generating a qualified strand majority opinion for the channel when the majority of the strands of the channel have detected a failure in the transmitter; and (iii) after the qualified majority opinion for the channel has been generated, transmitting means for transmitting the qualified majority opinion for the channel to the other strands of the channel via the private bus of the channel. 12. A multi-channel system according to claim 11, wherein the processor of each branch generates a final branch majority opinion of each channel before generating the channel majority opinion, the final branch majority opinion of each channel indicating whether a majority of the branches of the channel have continued to detect the failure in the transmitter after the branch majority opinion for the channel has been qualified with: (a) receiving means for receiving a set of qualified strand majority opinions from each channel, the set from each channel comprising the qualified strand majority opinion from the channel as qualified and transmitted by each strand of the channel; and (b) for the set of qualified string majority opinions of each channel, generating means for generating the final string majority opinion of the channel as a function of the set of qualified or qualified string majority opinions of the channel. 13. The multi-channel system of claim 12, wherein the final thread majority opinion of the channel by the processor is generated from each strand by determining means for determining whether a majority of strands have persistently generated a qualified strand majority opinion indicating that the transmitter is about to experience a failure, wherein the processor of each channel generates the channel majority opinion with: for each leg of the channel, determining means for determining whether a majority of the channels have consistently produced a final majority opinion that the transmitter is experiencing a failure, wherein the processor of each leg generates a bus validity signal as a function of the channel majority opinion, the bus validity signal indicating whether the data bus to which the transmitter is connected is about to experience a failure, wherein the processor of each leg generates a satisfactory transmitter signal as a function of the channel majority opinion and an inactive transmitter signal indicating whether the transmitter is inactive, the satisfactory validity signal indicating whether the transmitter is about to experience an intermittent failure, wherein the transmitter of each Line generates the channel freshness signal as a function of the majority channel statement or the channel majority statement, the bus validity signal and the satisfactory transmitter or transmitter signal with: - means for determining whether the transmitter or transmitter is a channel; - if the transmitter is a channel, determining means for determining whether any of the channel majority opinion, the bus validity signal or the satisfactory transmitter signal indicates that an error has been detected; and - determining means for determining whether the transmitter has transmitted a message within a predetermined time interval when a failure has been detected, the processor generating from each branch a line replaceable unit freshness signal as a function of the channel majority opinion, the bus validity signal and the satisfactory transmitter signal, comprising: - if the transmitter is not a channel and is accordingly a line replaceable unit, determining means for determining whether any of the channel majority statement, the bus validity signal or the satisfactory transmitter signal indicates that a failure has been detected; and - determining means for determining whether the branch has received a message from the transmitter within the predetermined time interval when a failure has been detected, the processor of each branch generating the inactive transmitter signal as a function of the channel freshness signal and the line replaceable unit freshness signal, comprising: - means for determining whether the transmitter or transmitter is a channel; - if the transmitter is a channel, determining means for determining whether the channel freshness signal has indicated that the transmitter has not transmitted a message within a predefined time interval; - if the transmitter is a line replaceable unit, determining means for determining whether the line replaceable unit signal has indicated that the branch has not received a message from the line replaceable unit within the predefined time interval, wherein the processor of each branch receives the satisfactory transmitter or transmitter signal as a function of the channel majority position and the inactive transmitter or transmitter signal generated with: - determining means for determining whether the channel majority opinion is changing persistently from the indication that the transmitter or transmitter is not currently experiencing a fault or failure to the indication that the transmitter or transmitter is currently experiencing a fault or failure; and - Determining means for determining whether the inactive transmitter or transmitter signal changes continuously from the indication that the transmitter or transmitter is active to the indication that the transmitter or transmitter is inactive. 14. The multi-channel system of claim 11, wherein the processor generates from each thread a thread failure signal after generating the thread majority opinion if only one thread in the channel has generated a failure signal indicating that the transmitter is currently transmitting a message over the global bus that has excessive errors, wherein the thread failure signal indicates whether the thread is possibly about to experience a failure, wherein the processor ascertains from each thread that the thread has experienced a failure by determining whether the thread has been continuously generating thread failure signals. 15. The multi-channel system of claim 12, wherein the processor of each thread generates a final thread failure signal after generating the final thread majority opinion if only one thread in the channel has generated an error signal indicating that the transmitter is currently transmitting a message over the global bus that has excessive errors, wherein the final thread failure signal indicates whether the thread may be currently experiencing a failure, wherein For each thread, the processor verifies that the thread has experienced a fault by determining whether the thread has generated sustained definitive thread fault or failure signals indicating that the thread may be experiencing a fault or failure.